Forensics commonly refers to the scientific methods of collecting and examining information or forensic data that can be used as a source of evidence in a legal or an administrative proceeding, for example, an audit, a regulatory investigation, a civil or criminal investigation, or internal investigations of employee wrongdoing. An essential part of forensic technology is automation of collection of forensic data from a target computer of which at least one of the users is a suspect in a case under investigation. Historically, collecting forensic data from a target computer requires capturing the whole hard drive of the computer, which obviously takes a great deal of storage capacity on a system managing the data; especially when same or similar data from a target computer has to be acquired frequently, for example, on a daily or weekly basis, the growth of the collected data and space demanded for storing such data can be substantial.